Skip to content

Pin GitHub Actions to commit SHAs - #92

Open
github-security-bot wants to merge 1 commit into
mainfrom
pinner/actions-sha-pins-2026-09-10
Open

Pin GitHub Actions to commit SHAs#92
github-security-bot wants to merge 1 commit into
mainfrom
pinner/actions-sha-pins-2026-09-10

Conversation

@github-security-bot

@github-security-bot github-security-bot commented Sep 10, 2026 •
edited by mrecachinas
Loading

Copy link
Copy Markdown

Pins GitHub Actions uses: references in github/issue-parser to immutable commit SHAs.

Summary

Metric Count
Files changed 6
Files scanned 5
Refs found 16
Refs pinned 16
Skipped refs 0
Warnings 0
Errors 0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

  • Original refs are preserved in inline comments when possible.
  • Pin comments use the Dependabot-compatible original-ref style.
  • Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
  • No minimum action age was enforced for this run.

Pinned refs

Location Before After Resolved as
.github/workflows/check-dist.yml:27 actions/checkout@v6 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 tag
.github/workflows/check-dist.yml:31 actions/setup-node@v6 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 tag
.github/workflows/check-dist.yml:56 actions/upload-artifact@v7 actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a tag
.github/workflows/codeql.yml:34 actions/checkout@v6 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 tag
.github/workflows/codeql.yml:38 github/codeql-action/init@v4 github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 tag
.github/workflows/codeql.yml:44 github/codeql-action/autobuild@v4 github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 tag
.github/workflows/codeql.yml:48 github/codeql-action/analyze@v4 github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 tag
.github/workflows/continuous-delivery.yml:34 actions/checkout@v6 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 tag
.github/workflows/continuous-delivery.yml:41 actions/setup-node@v6 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 tag
.github/workflows/continuous-delivery.yml:57 issue-ops/semver@v3 issue-ops/semver@e58d2f490332e0310a78e9a0e935d8d6f898e9e3 tag
.github/workflows/continuous-delivery.yml:70 issue-ops/releaser@v3 issue-ops/releaser@41bcc03658669135298bb08b60f043f1e02bf10e tag
.github/workflows/continuous-integration.yml:23 actions/checkout@v6 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 tag
.github/workflows/continuous-integration.yml:27 actions/setup-node@v6 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 tag
.github/workflows/linter.yml:27 actions/checkout@v6 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 tag
.github/workflows/linter.yml:33 actions/setup-node@v6 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 tag
.github/workflows/linter.yml:44 oxsecurity/megalinter/flavors/javascript@v9 oxsecurity/megalinter/flavors/javascript@ef3e84b8b836d76db562d0f3ed7da61e8fd538bc tag

Dependabot

  • Added a 7-day cooldown (cooldown: default-days: 7) to the existing github-actions Dependabot configuration.
  • The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Generated by pinner 0.1.0.

Copilot AI balanced review requested due to automatic review settings September 10, 2026 21:29
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 5 0 0 0.04s
❌ ACTION zizmor 5 1 0 0.84s
✅ JSON jsonlint 23 0 0 0.2s
✅ JSON npm-package-json-lint yes no no 0.66s
✅ JSON prettier 23 0 0 0.9s
✅ JSON v8r 23 0 0 12.74s
✅ MARKDOWN markdownlint 1 0 0 1.06s
✅ REPOSITORY betterleaks yes no no 0.88s
✅ REPOSITORY checkov yes no no 21.01s
✅ REPOSITORY gitleaks yes no no 1.06s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 74.48s
❌ REPOSITORY osv-scanner yes 45 no 1.67s
✅ REPOSITORY secretlint yes no no 0.95s
✅ REPOSITORY syft yes no no 2.85s
✅ REPOSITORY trivy-sbom yes no no 0.67s
✅ REPOSITORY trufflehog yes no no 13.33s
✅ TYPESCRIPT eslint 8 0 0 6.37s
✅ TYPESCRIPT prettier 8 0 0 0.79s
✅ YAML prettier 19 0 0 0.63s
✅ YAML v8r 19 0 0 10.1s
✅ YAML yamllint 19 0 0 0.54s

Detailed Issues

❌ REPOSITORY / osv-scanner - 45 errors 
Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 527 packages
End status: 47 dirs visited, 171 inodes visited, 1 Extract calls, 33.336496ms elapsed, 33.336662ms wall time

Total 16 packages affected by 45 known vulnerabilities (1 Critical, 28 High, 14 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
45 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                        | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)              | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev)            | 0.16.7  | 0.16.8        | package-lock.json |
| https://osv.dev/GHSA-w5vr-8v7q-w6rv | 6.6  | npm       | baseline-browser-mapping (dev) | 2.10.9  | 2.11.0        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-2qvq-rjwj-gvw9 | 4.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-2w6w-674q-4c4q | 9.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-3mfm-83xf-c92r | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-442j-39wm-28r2 | 3.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-7rx3-28cr-v5wh | 4.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-9cx6-37pm-9jff | 7.5  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xhpv-hc6g-r9c6 | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xjpj-3mr7-gcpf | 8.2  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)                | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
❌ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'artipacked' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'artipacked' audit
    1: couldn't list tags for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

All references match their documented release tags, and the Dependabot configuration is valid.

Pull request overview

Pins all GitHub Actions dependencies to immutable SHAs and adds a Dependabot cooldown.

Changes:

  • Pins all 16 action references while retaining version comments.
  • Adds a seven-day GitHub Actions update cooldown.
File summaries
File Description
.github/workflows/check-dist.yml Pins build-check actions.
.github/workflows/codeql.yml Pins CodeQL actions.
.github/workflows/continuous-delivery.yml Pins release actions.
.github/workflows/continuous-integration.yml Pins CI actions.
.github/workflows/linter.yml Pins linting actions.
.github/dependabot.yml Adds the cooldown.
Review details
  • Files reviewed: 6/6 changed files
  • Comments generated: 0
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@ncalteen ncalteen Awaiting requested review from ncalteen ncalteen is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@github-security-bot